From 3196265e97c661d9e9be04d5d64ca8ff3186536d Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 23 Jan 2007 12:25:08 +0000 Subject: s2io bogus memset memset() after kmalloc() on size * 8 would better be on size * 8, not just size; fixed by switching to kcalloc() - it's more idiomatic anyway. Signed-off-by: Al Viro Signed-off-by: Jeff Garzik --- drivers/net/s2io.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c index 250cdbeefdfd..1dd66b8ea0fa 100644 --- a/drivers/net/s2io.c +++ b/drivers/net/s2io.c @@ -556,10 +556,9 @@ static int init_shared_mem(struct s2io_nic *nic) } } - nic->ufo_in_band_v = kmalloc((sizeof(u64) * size), GFP_KERNEL); + nic->ufo_in_band_v = kcalloc(size, sizeof(u64), GFP_KERNEL); if (!nic->ufo_in_band_v) return -ENOMEM; - memset(nic->ufo_in_band_v, 0, size); /* Allocation and initialization of RXDs in Rings */ size = 0; -- cgit v1.2.3 From d344bff9c36db17dc4765215495aaa7212c1eb6c Mon Sep 17 00:00:00 2001 From: Dale Farnsworth Date: Tue, 23 Jan 2007 09:52:25 -0700 Subject: mv643xx_eth: Fix race condition in mv643xx_eth_free_tx_descs mv643xx_eth: Fix race condition in mv643xx_eth_free_tx_descs This bug was found and isolated by Thibaut VARENE and Jarek Poplawski . This patch is a modification of their fixes. We acquire and release the lock for each descriptor that is freed to minimize the time the lock is held. Signed-off-by: Jeff Garzik --- drivers/net/mv643xx_eth.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index c41ae4286eea..b3bf86422734 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -314,6 +314,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force) while (mp->tx_desc_count > 0) { spin_lock_irqsave(&mp->lock, flags); + + /* tx_desc_count might have changed before acquiring the lock */ + if (mp->tx_desc_count <= 0) { + spin_unlock_irqrestore(&mp->lock, flags); + return released; + } + tx_index = mp->tx_used_desc_q; desc = &mp->p_tx_desc_area[tx_index]; cmd_sts = desc->cmd_sts; @@ -332,13 +339,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force) if (skb) mp->tx_skb[tx_index] = NULL; - spin_unlock_irqrestore(&mp->lock, flags); - if (cmd_sts & ETH_ERROR_SUMMARY) { printk("%s: Error in TX\n", dev->name); mp->stats.tx_errors++; } + spin_unlock_irqrestore(&mp->lock, flags); + if (cmd_sts & ETH_TX_FIRST_DESC) dma_unmap_single(NULL, addr, count, DMA_TO_DEVICE); else -- cgit v1.2.3